Checklist Summary:

The Windows Dedicated Administrative Workstation (DAW) Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. This document is meant for use in conjunction with the appropriate version of the Windows STIG. The Windows DAW STIG provides configuration and installation requirements for dedicated Windows workstations used exclusively for remote administrative management of designated high-value IT resources, including servers, workstations, directory services, applications, databases, and network components. A high-value IT resource is defined as any IT resource whose purpose is considered critical to the organization or whose loss or compromise would cause a significant impact on the organization. These dedicated administrative workstations are referred to as “admin platforms”, Privileged Access Workstations (PAW), and Secure Admin Workstations (SAW) by various STIGs and vendors. The term “Dedicated Administrative Workstation” will be used in this STIG so that a vendor-specific term, such as PAW or SAW, is not used. The following topics are not in scope for this STIG: • Rules for setting up and managing privileged accounts (roles, least privilege, etc.) • Rules for monitoring privileged accounts • Rules for user account restrictions on IT resources (functions restricted to only privileged account users on IT resources) • Requirements related to when and how an Authorizing Official (AO) determines which IT resources are designated as “high value” This STIG assumes the applicable Windows STIG has been applied to the DAW prior to the implementation of the technical controls listed in this STIG. If one or more DAWs are installed as virtual machines (VMs) on a host server, this STIG assumes the applicable VM product STIG has been applied. Note that some configurations required by this STIG may need to be implemented in the domain rather than on the DAW. Microsoft’s Privileged Access Workstation paper (https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations) was a key reference used during the development of this STIG. It is recommended that system administrators review the paper as they plan the rollout of site DAWs. See information on the Microsoft Tier model at https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#ADATM_BM. Administrators of high-value IT assets have no administrator rights on the DAW itself.

Checklist Role:

• Application Server

Known Issues:

Not provided.

Target Audience:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Information Assurance Support Environment (IASE) website. This site contains the latest copies of any STIGs, SRGs, and other related security information. The address for the IASE site is http://iase.disa.mil/.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Updated to Final - 3/5/2018

Dependency/Requirements:

URL	Description

References:

Reference URL	Description
https://iasecontent.disa.mil/stigs/pdf/U_MS_Windows_Privileged_Access_Workstation_STIG_V1R1_Release_Memo.pdf	Microsoft Windows Privileged Access Workstation (PAW) STIG Version 1 - Release Memo

NIST checklist record last modified on 03/05/2018